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[ts engaged in preparation of a strategic plan for infor- 
mation system development. We envisage a central computer system 

in the future Headquarters linked to sub-systems in 25X14 
eight regional offices by secure data inks in a star configuration. 
The primary purpose of the system is to aid in the input, storage 
retrieval and collation of intelligence relevant to security, and 

in security checking of persons who may have access to classified 
information or who have applied for visas or citizenship. 


2. Regional office sub-systems will mainly be used for the input 
and editing of intelligence reports and messages, the transmission 
of these to the central system, the retrieval of records from the 
central system, and the receipt of messages from Headquarters and 
other regions, 


3. When the system is operating documents created within the 
TE be captured on-line at time of creation. Intelligence 
reports will be partly structured, partly free text. The structured 
part will include iniportant names, dates and places, a descriptor 

list and, for ldhg documents, possibly an abstract. The structured 


part will be stored in a structured data base and managed by DBMS 


software. «Within this database will be indexes to the full text 
documents., The latter will be stored in a separate text data base. 
Correspondanéa (outwards) and telexes will be classified according 
to document type, subject matter etc. Subject and name indexes to 
corresponderice and telexes will be stored in the structured data~ _ 
base. | 7 

4. The free bekxt portion of reports, correspondence and telexes 
will be starad in a text database which may be accessed via indexes 
in the structured database or via a search of text. 


| . 

5. Consideration is being given to a microform database indexed 
on the computer for documents which cannot easily be captured on- 
line such as inwards correspondence and news clippings. 


6. The main subsystems or modules are therefore: 


a) Name searching and other identification aids; 

b) Database management including partial indexes to 
, textual documents and microfiches; 

c) Text storage and retrieval; 

d) Text antry and editing; 

e) Inter-office electronic mail; 

f) Implementation of need-to-know principle. 


7. Major applications are aid to: 
a) Security checking of individuals; ~~~ 
b) Collation and assessment of intelligence relating 
zo subversion, espionage and politically motivated 
violence; 
c) Movement analysis of Soviet officials. 
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8. It would be helpful if the discussions could cover the 
following topics, 

a) What computers do you have? What applications do you 


use them for? What operating system(s) do you use? 


b) Do you use any of the following? -Which? What has been 
your experience with each? 


i) Text storage and retrieval software; 
ii) Special purpose hardware for text search; 
iii) Data base management. software. 


c) Have you attempted to link or integrate DBMS with a text 
storage and retrieval system? With what result? For 
example, do you manage indexes to text files using a DBMS? 


d) ££ you store data or text relevant to security on-line, 
what kinds of query are most commonly made to the system 
to retrieve this information? For the kinds of query you 
most often make de you mostly access structured data or 
free text? 


e) Do you use any system for electronic mail. within your 
organisation? Who supplied it? What is your experience 
with it? 


ee £) 


bc ocessing on-line 
and ‘text been tion an editing by intelligence officers and/ 
or police officers? 


+r¢y g) Have you integrated or attempted to integrate word processing, 
electronic mail, 1and on-line document - pe aGee Sue PECh EAC vere 
What is your experience so far? 


hh) De you provide intellligence officers or police officers with 
personal computing capahility or the facility to create and 
store personal files? What has been your experience with this? 


jfooi) What hame grouping or name searching packages do you use? 
Haye you evaluated others? With what result? 


ips) Do you have a need to retrieve records by Chinese, Vietnamese 
or Arabic names? If so, does your name search[ |work 
well for these? 


oc, Kk) What data encryption techniques and devices do you use for 


i) Data transmission; 
ii) Data storage; 


What has been your experience with them? Do you plan to 
make any changes? 

26 1) What techniques do you use for the management of selective 
access to conmputer- 


i) files; 
i414.)  folros; 


iii) text paragraphs; 
iv) paragraphs; 

v) records; 
vi} data items. 
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a. It would be helpful if 
Gott ean cones: P if the discussions could cover the 


a) What computers do you have? What applications doa you 
use them for? What operating system(s) do you use? 


b) Do you use any of the following? Which? What has been 
your experience with each? 
i) Text storage and retrieval software; 


ii) Special purpose hardware for text search; 
jii) Data base management software, 


c) Have you attempted to link or integrate DBMS with a text 
storage and retrieval system? With what result? For 
example, do you manage indexes to text files using a DBMS? 


d) If you store data or text relevant to security on-line, 
what kinds of query are most commonly made to the system 
to retrieve this information? For the kinds of query you 
most often make do you mostly access structured data or 
free text? ; 


e) Po yeu use any system for electronic mail within your 
organisation? Who supplied it? What is your experience 
with it? - 

toe of fae tee gta Frruet aye Oa, fh Pin. 

f£) What nas’ B26 POae eebationce” with ie ee on-line 
and text creation and editing by intelligence officers and/ 
or police officers? 


Have you integrated or attempted to integrate word processing, 
electronic mail, |and on-line document - storage-and-retrieval? 
What is your experience so far? 


rovide ; i Lice officers with 
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to retrieve records by Chinese; 
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k) What data encryption techniques ana devices do 


i) Data transmission: 
ii) Data storage; 


What has been your experit 7 with them? Po you . 
make any changes? 


What techniques do you use ! 1e management Of 8. 


access to computer 


i) files; 

ii) folios; 
jii) text paragraphs; 
iv) paragraphs; 

y) records; 

vi) data items. 
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If you haye a micrographics data base:- 


i) Is it indexed on your computer? 
ii) How is security of the micrographics data base managed 
considering that a fiche can show up to several hundred 
frames. 


Are your workstations tempest standard or equivalent? 


Do you maintain a complete log of all attempts to access: 


i) The computer Catabases; 
ii) The microform databases (if any); 
iii) The paper data base. 


Do you analyse this log for unusual patterns of attempted 
access? 


What techniques do you employ for testing the security of 
your: 


i) Computer system? 
ii) Micrographics system (if any)? 


What arrangements do you have to provide backup during loss 
of service? What arrangements do you have for recovery of 
service after a Failure? Are these adequate? 


What protection do you have against theft or clandestine 
copying of portable storage media such as disks, tapes or 
microfiche? In particular, how are these controls applied 
to privileged out-of-hours workers such as engineers and 


| programmers? 


i 
What controls’ do you apply to ensure that documents are not 
modified or purged from files? 


Do you conduct independent vetting of vendor software 
(eg. operating system, DBMS, communications) to look for 
trapdoors? 
: eee 2 
Is computer memory purged when not in use? ~ PP 


What techniques are employed to identify terminal users? 
Who inspects event logs and how frequently? 


Are repeated attempts by unauthorised persons to access data 


breught automatically and immediately to the security officer's 


attention? 
If history Logs are in use, how are they protected? 


Is off-site storage of (Ll data employed? If so, 
how is it protected? "4 


Is your communications network physically isolated from the 
public network? If so, how frequently are they used? 
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Are alternative data paths available in the communications 
network? If so, how frequently are they used? 


[Lf you use computer-output-micrvform (com.), what kind of 
equipment and what has been your experience? 


If you have substituted a magnetic media/computer system 

for an earlier paper file system, what did you do with the 
old files? For example, did you convert them to magnetic 
media or do you manage the old paper files in parallel with 
the new computer system files? 


How many persons do you have engaged in: 


i) Computer programming? 
ii) Computer operations? 
iii) Computer maintenance? 
iv) Computer systems administration? 
v) Other areas of information management? 


Do you do your own computer maintenance? 


Did the introduction of a computer reducé or increase the 
nuinber of people engaged in: 
aaa ae ee eae 
i) Information management? 
di) Any other areas of your organisation? 


De you consider your computer to be justified by: 


i) Cost°savings?. 
ii). More timely information? 
iii) Mofe accurate information? 
‘iv) More complete information available? 
v) Better or easier collation of information? 
vi) Other reasons? ‘ 


Do you have a: 
i) Data administrator? 
ii) Data base administrator? 
iii) Data security officer? 
To whom do these positions report and where are they in your 
organisation? 


Do you store raw intelligence on computer files (eg. intercept - 
reports and agent reports) or only assessed intelligence? If 
the latter, do you maintain an index. on the computer to raw 
intelligence reports? 


What kinds of workstation do you use for: 


i) .Word processing? 
ii)  Micrographics retrieval and viewing? 
iii) Data base query and viewing? 
iv) Computer-stored text query and viewing? 


Do intelligence assessors use workstations for researc? 
Do you find the stations or terminals suitable for browsing? 


Do you use lightpens, jostick controls (for scrolling) or 


other non-keyboard facilities for more effective operation 
of work stations? 
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7 « NN) Would-any of the software you have developed be available 
yhAS . i H 
to us and under what conditions? 
WAS oo) If you do not at present do or use any of the things 
v mentioned above, do you plan to do so in future? 
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